CVE-2026-40906

HighCVSS 8.8/10Last modified Jul 15, 2026

Description

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
electric-sql	electric	>= 1.1.12, < 1.5.0
Red Hat	Red Hat Developer Hub	—

References

https://github.com/electric-sql/electric/pull/4081Exploit, Issue Tracking
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hjExploit, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-40906
https://bugzilla.redhat.com/show_bug.cgi?id=2460291
https://github.com/electric-sql/electric/security/advisories/GHSA-h5rg-pxx7-r2hjExploit, Vendor Advisory
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40906.json

Timeline

Published: Apr 21, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-409076.5WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` conta CVE-2026-409085.3WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and CVE-2026-409096.5WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file pat CVE-2026-40916.1The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to CVE-2026-409109.1frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUse CVE-2026-4091110.0WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied J CVE-2026-409128.2Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authenticati CVE-2026-409144.3A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the con CVE-2026-409157.8A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a speciall CVE-2026-409165.5A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a CVE-2026-409177.1A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially craft CVE-2026-409185.5A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This oc